---
name: "landlock_create_ruleset"
section: "2"
platform: "linux"
package: "man-pages"
version: "6.19-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/landlock_create_ruleset"
---

# landlock\_create\_ruleset(2)

create a new Landlock ruleset

## NAME

landlock\_create\_ruleset - create a new Landlock ruleset

## LIBRARY

Standard C library (*libc*, *-lc*)

## SYNOPSIS

```
#include <linux/landlock.h>  /* Definition of LANDLOCK_* constants */
#include <sys/syscall.h>     /* Definition of SYS_* constants */
#include <unistd.h>
```

**int syscall(SYS\_landlock\_create\_ruleset,**             **const struct landlock\_ruleset\_attr \****attr***,**             **size\_t** *size* **, uint32\_t** *flags***);**

## DESCRIPTION

A Landlock ruleset identifies a set of rules (i.e., actions on objects). This **landlock\_create\_ruleset**() system call creates a new file descriptor which identifies a ruleset. This file descriptor can then be used by [**landlock\_add\_rule**(2)](/landlock_add_rule/2.md) and [**landlock\_restrict\_self**(2)](/landlock_restrict_self/2.md). See [**landlock**(7)](/landlock/7.md) for a global overview.

*attr* specifies the properties of the new ruleset. It points to the following structure:

-

  ```
  struct landlock_ruleset_attr {
      __u64 handled_access_fs;
      __u64 handled_access_net;
      __u64 scoped;
  };
  ```

-

  *handled\_access\_fs* is a bitmask of handled filesystem actions (see **Filesystem actions** in [**landlock**(7)](/landlock/7.md)).

-

  *handled\_access\_net* is a bitmask of handled network actions (see **Network actions** in [**landlock**(7)](/landlock/7.md)).

-

  *scoped* is a bitmask of scope flags (see **Scope flags** in [**landlock**(7)](/landlock/7.md)).

-

  This structure defines a set of *handled access rights*, a set of actions on different object types, which should be denied by default when the ruleset is enacted. Vice versa, access rights that are not specifically listed here are not going to be denied by this ruleset when it is enacted.

-

  For historical reasons, the **LANDLOCK\_ACCESS\_FS\_REFER** right is always denied by default, even when its bit is not set in *handled\_access\_fs*. In order to add new rules with this access right, the bit must still be set explicitly (see **Filesystem actions** in [**landlock**(7)](/landlock/7.md)).

-

  The explicit listing of *handled access rights* is required for backwards compatibility reasons. In most use cases, processes that use Landlock will *handle* a wide range or all access rights that they know about at build time (and that they have tested with a kernel that supported them all).

-

  This structure can grow in future Landlock versions.

*size* must be specified as *sizeof(struct landlock\_ruleset\_attr)* for compatibility reasons.

*flags* must be 0 if *attr* is used. Otherwise, *flags* can be set to:

- **LANDLOCK\_CREATE\_RULESET\_VERSION**

  Return the highest supported Landlock ABI version (starting at 1). This version can be used for a best-effort security approach, which is encouraged when user space is not pinned to a specific kernel version.

-

  Unless noted otherwise, all features documented in these manual pages are available with the version 1.

- **LANDLOCK\_CREATE\_RULESET\_ERRATA**

  Return a bitmask of fixed issues for the current Landlock ABI version. If bit N is set (i.e., *errata & (1 \<\< (N - 1))*), then erratum N has been fixed in the running kernel.

-

  In addition to ABI versions, Landlock's errata mechanism tracks fixes for issues that may affect backwards compatibility or require userspace awareness.

-

  Only check errata if your application specifically relies on behavior that changed due to the fix.

-

  The full list of Landlock errata is available at ⟨https:\\://docs.kernel.org/\\:userspace\\-api/\\:landlock.html#landlock\\-errata⟩.

-

  This flag is available on all Linux versions where Landlock errata were fixed. This specifically includes all newest bugfix releases of stable kernels where Landlock is supported.

If **LANDLOCK\_CREATE\_RULESET\_VERSION** or **LANDLOCK\_CREATE\_RULESET\_ERRATA** is set, then *attr* must be NULL and *size* must be 0.

## RETURN VALUE

On success, **landlock\_create\_ruleset**() returns a new Landlock ruleset file descriptor, a Landlock ABI version, or a Landlock errata bitmask, according to *flags*.

On error, -1 is returned and *errno* is set to indicate the error.

## ERRORS

**landlock\_create\_ruleset**() can fail for the following reasons:

- **E2BIG**

  *size* is too big.

- **EFAULT**

  *attr* was not a valid address.

- **EINVAL**

  Unknown *flags*, or unknown access, or unknown scope, or too small *size*.

- **EINVAL**

  Non-NULL *attr* or non-zero *size* in combination with **LANDLOCK\_CREATE\_RULESET\_VERSION** or **LANDLOCK\_CREATE\_RULESET\_ERRATA**.

- **ENOMSG**

  Empty accesses (i.e., *attr* did not specify any access rights to restrict).

- **EOPNOTSUPP**

  Landlock is supported by the kernel but disabled at boot time.

## STANDARDS

Linux.

## HISTORY

Linux 5.13.

## EXAMPLES

See [**landlock**(7)](/landlock/7.md).

## SEE ALSO

[**landlock\_add\_rule**(2)](/landlock_add_rule/2.md), [**landlock\_restrict\_self**(2)](/landlock_restrict_self/2.md), [**landlock**(7)](/landlock/7.md)